Public mode

No access to your tenant or devices. Every item links to its source. What this means

No source readable: 0/272 feeds/APIs · 438/469 docs · 8/9 advisories · Refresh failed Customize Public modeDiscuss ChangeIntel on Discord

drm/vc4: Disable the V3D interrupt across runtime suspend

Assessment

Severity
Moderate
CVSS base score
4.7CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
Impact
Not stated
EPSS, next 30 days
Not scored yet
Public exploit code
No Nuclei template lists it
Exploitability
Not assessed
Publicly disclosed
No
Customer action
Required: apply the update
Component
Mariner
Weakness
—
Issued by
Linux
Published
24 Oct 2026 · October 2026
Last revised
26 Oct 2026Information published.
CVSS 3.1 base metricsRed raises the risk · green lowers it
Attack vector
LocalAV:L
Attack complexity
HighAC:H
Privileges required
LowPR:L
User interaction
NoneUI:N
Scope
UnchangedS:U
Confidentiality
NoneC:N
Integrity
NoneI:N
Availability
HighA:H

Updates that fix it

0 KBs

No KB listed

MSRC lists no downloadable update, which usually means a service-side fix or a release-notes update. Check the MSRC advisory.

Affected products

1 affected product
  • azl3 kernel 6.6.157.1-1 on Azure Linux 3.0
Page history

Changes are dated when recorded; day views use the last saved version from that UTC day, and citations stay fixed.

Cite this version
Field-level log (0)

Up to 100 recent field edits are shown; older edits may be outside retention.

No retained field changes for this selection.

Explore global source statements, affected packages and advisory history for CVE-2026-98946. The catalog has a separate collection scope from Microsoft release records.

Collected exploitation and prediction evidence

Risk source coverage

CISA KEV is observed exploitation evidence. FIRST EPSS is a dated prediction of exploitation in the next 30 days. Missing scores are unknown. This collector requests predictions only for explicit CVE aliases in the public NuGet archive; Microsoft release views retain their existing prediction scope.

No collected risk observation for these identifiers. This does not establish absence of exploitation or a zero probability.

cve-program · CVE-2026-98946

Published

drm/vc4: Disable the V3D interrupt across runtime suspend

In the Linux kernel, the following vulnerability has been resolved: drm/vc4: Disable the V3D interrupt across runtime suspend vc4_irq_disable() masks the V3D interrupt sources and then calls synchronize_irq() before the V3D is powered down. However, by itself, this is not enough to quiesce the interrupt handler. synchronize_irq() waits for handlers that have already set IRQD_IRQ_INPROGRESS, and for irqchips reporting IRQCHIP_STATE_ACTIVE. A GIC interrupt chip is able to mark an interrupt active as soon as a CPU acknowledges it, so there these checks cover the whole dispatch path. On RPi 0-3, however, the interrupt controller is ARMCTRL, which has no active state. A CPU that has read the hwirq out of the pending register but has not yet reached handle_level_irq() stays invisible to synchronize_irq(). During a power transition, vc4_irq() may therefore run after the power domain is off, where every V3D register read will return 0xdeadbeef. 0xdeadbeef has FLDONE, FRDONE and OUTOMEM set. This problem doesn't trigger NULL pointer dereference issues only because the functions vc4_irq_finish_bin_job() and vc4_irq_finish_render_job() return early when there is no job pointer, but OUTOMEM is still able to schedule vc4_overflow_mem_work() after vc4_irq_disable() has already cancelled it. Therefore, fix the spurious interrupts by disabling the interrupt line across the PM transition. To preserve the enable/disable balance, move vc4_irq_install() and request the IRQ line disabled before the first runtime resume.

Source published
23 Oct 2026 12:19:05 UTC
Source modified
23 Oct 2026 12:19:05 UTC
Observed here
23 Oct 2026 16:01:20 UTC
Source terms
CVE Program Terms of Use

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: cve-program · CVE Program Terms of Use. Source text is retained; field grouping and change labels are provided by ChangeIntel.

ChangeIntel

An IT change radar: releases, security, known issues, retirements, documentation changes, and service status from public sources. Every item links to supporting evidence; dates and statuses can change after they are read.

Public refresh failed; check source status · documentation 438/469 current